Gradle up to 7.6.2/8.3 permission assignment

Summaryinfo

A vulnerability was found in Gradle up to 7.6.2/8.3. It has been rated as problematic. This vulnerability affects unknown code. The manipulation leads to permission assignment. This vulnerability is traded as CVE-2023-44387. An attack has to be approached locally. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Gradle up to 7.6.2/8.3. This issue affects an unknown function. The manipulation with an unknown input leads to a permission assignment vulnerability. Using CWE to declare the problem leads to CWE-732. The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. Impacted is confidentiality. The summary by CVE is:

Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves them but applies the permissions of the symlink itself instead of the permissions of the linked file to the resulting file. This leads to files having too much permissions given that symlinks usually are world readable and writeable. While it is unlikely this results in a direct vulnerability for the impacted build, it may open up attack vectors depending on where build artifacts end up being copied to or un-archived. In versions 7.6.3, 8.4 and above, Gradle will now properly use the permissions of the file pointed at by the symlink to set permissions of the copied or archived file.

The weakness was shared 10/06/2023 as GHSA-43r3-pqhv-f7h9. The advisory is shared at github.com. The identification of this vulnerability is CVE-2023-44387 since 09/28/2023. Neither technical details nor an exploit are publicly available.

Upgrading to version 7.6.3 or 8.4 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 3b406191e24d69e7e42dc3f3b5cc50625aa930b7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Gradle

Version

• 7.6.0
• 7.6.1
• 7.6.2
• 8.0
• 8.1
• 8.2
• 8.3

License

• open-source

Website

• Product: https://github.com/gradle/gradle/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion